Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/06/2026, 11:14
General
- Target 2026-06-05_d52cf541f403c4ed8aa259dfde585918_elex_wannacry.exe
- Size 66KB
- Sample260605-nb7ttsfs8n
- SHA256 96b5a50f4050f469426a44eb15f6a8ca0f4eb87d446310c2395aa7963f178df6
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_d52cf541f403c4ed8aa259dfde585918_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_d52cf541f403c4ed8aa259dfde585918_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0DF9281-7B85-44af-AA78-DC4C11F91CB9}.exeC:\Windows\{A0DF9281-7B85-44af-AA78-DC4C11F91CB9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{33CBAD32-DD2D-4b30-AD6B-3A9E6256957E}.exeC:\Windows\{33CBAD32-DD2D-4b30-AD6B-3A9E6256957E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E516415-AB48-4ac3-9E0D-D07BD6FD1A50}.exeC:\Windows\{7E516415-AB48-4ac3-9E0D-D07BD6FD1A50}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50DE4D50-34D6-445b-B2FE-D599EDAF17DE}.exeC:\Windows\{50DE4D50-34D6-445b-B2FE-D599EDAF17DE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35A40BA1-B1FF-408e-9BA1-4D97A30AE0FD}.exeC:\Windows\{35A40BA1-B1FF-408e-9BA1-4D97A30AE0FD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2158EDDE-B00E-4850-AAB3-85A14C56A734}.exeC:\Windows\{2158EDDE-B00E-4850-AAB3-85A14C56A734}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A3E34A1-B193-489d-A1D0-7521BB0C4441}.exeC:\Windows\{4A3E34A1-B193-489d-A1D0-7521BB0C4441}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16445FA1-AEA3-44be-8575-D1B279CED988}.exeC:\Windows\{16445FA1-AEA3-44be-8575-D1B279CED988}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C83D2084-4E19-4183-9602-B8269FC656FB}.exeC:\Windows\{C83D2084-4E19-4183-9602-B8269FC656FB}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C59985F-F479-4c48-BD29-01E1FC6BECEE}.exeC:\Windows\{3C59985F-F479-4c48-BD29-01E1FC6BECEE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9AF73E2B-83CC-4c5d-A913-1C65B46E2232}.exeC:\Windows\{9AF73E2B-83CC-4c5d-A913-1C65B46E2232}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C599~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C83D2~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16445~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A3E3~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2158E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35A40~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50DE4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E516~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{33CBA~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0DF9~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{16445FA1-AEA3-44be-8575-D1B279CED988}.exe
{2158EDDE-B00E-4850-AAB3-85A14C56A734}.exe
{33CBAD32-DD2D-4b30-AD6B-3A9E6256957E}.exe
{35A40BA1-B1FF-408e-9BA1-4D97A30AE0FD}.exe
{3C59985F-F479-4c48-BD29-01E1FC6BECEE}.exe
{4A3E34A1-B193-489d-A1D0-7521BB0C4441}.exe
{50DE4D50-34D6-445b-B2FE-D599EDAF17DE}.exe
{7E516415-AB48-4ac3-9E0D-D07BD6FD1A50}.exe
{9AF73E2B-83CC-4c5d-A913-1C65B46E2232}.exe
{A0DF9281-7B85-44af-AA78-DC4C11F91CB9}.exe
{C83D2084-4E19-4183-9602-B8269FC656FB}.exe